[dependabot]

Bumps pyo3 from 0.27.2 to 0.28.3.

Release notes

Sourced from pyo3's releases.

PyO3 0.28.3

This patch contains several fixes for stability of the PyO3 0.28.x series:

• Python::attach and Python::try_attach will no longer return before the thread initializing the interpreter has finished runnning site.py when using the auto-initialize feature.
• Fix unsoundness in PyBytesWriter::write_vectored when targeting the Python 3.15 prerelease interpreter.
• Fix possible deadlock in .into_pyobject() implementation for C-like #[pyclass] enums.

A couple of edge cases causing compile failures were also fixed.

Thank you to the following contributors for the improvements:

@​alex @​bschoenmaeckers @​chirizxc @​davidhewitt @​Embers-of-the-Fire @​Icxolu @​maurosilber @​ngoldbaum

PyO3 0.28.2

This patch release contains a soundness fix for subclassing native types such as PyList with the abi3 feature enabled when targeting a minimum version of Python 3.12 or higher. (Support for doing such subclassing was newly added in PyO3 0.28.0.)

PyO3 0.28.0 and 0.28.1 will be yanked.

This release also contains a correction to the FFI definition PyType_GetTypeDataSize and incorrectly-generated __qualname__ on #[pyclass] enum variant types when using #[pyo3(name = "...")] option to rename the enum and/or variant.

Thank you to the following contributors for the improvements:

@​davidhewitt @​Icxolu @​ngoldbaum

PyO3 0.28.1

This patch contains a number of minor compile-time fixes for PyO3 0.28.0.

Thank you to the following contributors for the improvements:

@​davidhewitt @​funsafemath @​ngoldbaum @​rara64 @​tdyas

PyO3 0.28.0

This release contains many improvements across PyO3's feature set:

• Proper support for __init__ methods for #[pyclass] types
• Support for #[deleter]s to complement the existing #[getter] and #[setter] attributes when implementing class "properties".
• Support for subclassing many Python types with the abi3 feature (requires Python 3.12+).
• A new #[pyclass(new = "from_fields")] option to automatically define the constructor from the class fields.
• Many corrections to FFI definitions (including removal of many private CPython methods)

... (truncated)

Changelog

Sourced from pyo3's changelog.

[0.28.3] - 2026-04-02

Fixed

• Fix compile error with #[pyclass(get_all)] on a type named Probe. #5837
• Fix compile error in debug builds related to _Py_NegativeRefcount with Python < 3.12. #5847
• Fix a race condition where Python::attach or try_attach could return before site.py had finished running. #5903
• Fix unsoundness in PyBytesWriter::write_vectored with Python 3.15 prerelease versions. #5907
• Fix deadlock in .into_pyobject() implementation for C-like #[pyclass] enums. #5928

[0.28.2] - 2026-02-18

Fixed

• Fix complex enum __qualname__ not using python name #5815
• Fix FFI definition PyType_GetTypeDataSize (was incorrectly named PyObject_GetTypeDataSize). #5819
• Fix memory corruption when subclassing native types with abi3 feature on Python 3.12+ (newly enabled in PyO3 0.28.0). #5823

[0.28.1] - 2026-02-14

Fixed

• Fix *args / **kwargs support in experimental-async feature (regressed in 0.28.0). #5771
• Fix clippy::declare_interior_mutable_const warning inside #[pyclass] generated code on enums. #5772
• Fix ambiguous_associated_items compilation error when deriving FromPyObject or using #[pyclass(from_py_object)] macro on enums with Error variant. #5784
• Fix __qualname__ for complex #[pyclass] enum variants to include the enum name. #5796
• Fix missing std::sync::atomic::Ordering import for targets without atomic64. #5808

[0.28.0] - 2026-02-01

Packaging

• Bump MSRV to Rust 1.83. #5531
• Bump minimum supported quote version to 1.0.37. #5531
• Bump supported GraalPy version to 25.0. #5542
• Drop memoffset dependency. #5545
• Support for free-threaded Python is now opt-out rather than opt-in. #5564
• Bump target-lexicon dependency to 0.13.3. #5571
• Drop indoc and unindent dependencies. #5608

Added

• Add __init__ support in #[pymethods]. #4951
• Expose PySuper on PyPy, GraalPy and ABI3 #4951
• Add PyString::from_fmt and py_format! macro. #5199
• Add #[pyclass(new = "from_fields")] option. #5421
• Add pyo3::buffer::PyUntypedBuffer, a type-erased form of PyBuffer<T>. #5458
• Add PyBytes::new_with_writer #5517
• Add PyClass::NAME. #5579
• Add pyo3_build_config::add_libpython_rpath_link_args. #5624

... (truncated)

Commits

• 743af64 release: 0.28.3
• 2042b4c fix deadlock when initializing enum via into_pyobject() (#5928)
• 0157247 ci: update UI tests for Rust 1.94 (#5859)
• e234f8a Update getting-started.md (#5899)
• c06848d fix ffi-check in 3.15.0a7 (#5873)
• 83f4283 remove unused try_trait_v2 feature when enabling the nightly feature (#5868)
• 0de57ed Fix unsoundness in PyBytesWriter::write_vectored (#5907)
• 49cd13f fixes #5900 -- address race condition with initialization and site.py loading...
• c90d163 [fix] Fix std::ffi import for _Py_NegativeRefcount (#5847)
• b79d725 fix(pyo3-macros): allow pyclass named Probe (#5837)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[prql-bot]

The bump itself resolves correctly, but pyo3 0.28 deprecates the automatic FromPyObject impl for #[pyclass] types that derive Clone, and CompileOptions in prqlc/bindings/prqlc-python/src/lib.rs is exactly that. The 📎 Clippy step in test-rust.yaml runs with -D warnings, so this turns the deprecation into a hard error and test-rust will fail once the queued matrix gets a runner:

error: use of deprecated associated constant `pyo3::impl_::deprecated::HasAutomaticFromPyObject::<true>::MSG`
   --> prqlc/bindings/prqlc-python/src/lib.rs:102:1
    |
102 | #[pyclass]

Reproduced locally with cargo clippy -p prqlc-python --all-targets -- -D warnings (exit 101). from_py_object is the migration to take rather than skip_from_py_object — compile and rq_to_sql both take Option<CompileOptions> as a #[pyfunction] parameter, and test_all.py passes prqlc.CompileOptions(...) into both, so dropping the derive would break the public API at runtime. Since nobody is here to act on the suggestion, I've pushed it:

// prqlc/bindings/prqlc-python/src/lib.rs, on `pub struct CompileOptions`
#[pyclass(from_py_object)]
#[derive(Clone, Debug)]

Two other things worth a maintainer's eye, neither blocking this PR:

pyo3-build-config is left at 0.27.1 (Cargo.toml line 58), so the lock now carries two copies of it. The effect is cosmetic today — build.rs only calls add_extension_module_link_args() — but #6258 proposes moving it to 0.29.2, which would leave the build-config crate a major ahead of pyo3 itself. 0.28.3 is the version that matches; #6258 is worth redirecting there (or closing in favour of a bump alongside this one).

abi3-py37 is why this stops at 0.28.3. pyo3 0.29 removed that feature (its lowest is abi3-py38, and it added abi3-py315), which is why Dependabot capped the bump here rather than going to 0.29.2. pyproject.toml already declares requires-python = ">=3.10", so moving the feature to abi3-py310 would both match what the package claims to support and unblock the next pyo3 major — but it narrows the ABI floor of a published wheel, so that's a call for a maintainer rather than something to fold into a dependency bump.

Other 0.28 migration items, checked against this codebase

From pyo3's 0.28 migration guide:

• Free-threaded Python is now opt-out. #[pymodule] no longer needs gil_used = false; the prqlc module will now declare that it doesn't require the GIL. Checked the compiler's process-global state for this: prqlc uses OnceLock (sql/operators.rs, sql/keywords.rs, codegen/ast.rs, utils/mod.rs, lib.rs) and one RwLock<Option<DebugLog>> (debug/log.rs) — all Sync, no static mut or non-Sync statics — and the bindings expose no way to start the debug log, so this looks safe.
• Multi-phase module initialization — upstream states no migration needed.
• Py::from_owned_ptr deprecations, PyClassInitializer From impl removal, PyBuffer → PyUntypedBuffer — none of these APIs are used here.
• Removed transitive deps (indoc, memoffset, unindent) have no direct dependents in this workspace.
• MSRV: pyo3 0.28 requires Rust 1.83; the workspace is on 1.85.0.
• cargo test -p prqlc-python passes (5 tests) with the fix applied.

[prql-bot]

This branch conflicts with main on Cargo.toml and Cargo.lock, and needs manual resolution rather than a rebuild.

The usual @dependabot recreate isn't safe here: the branch carries a non-Dependabot commit — e978f7c, "fix: opt in to FromPyObject for CompileOptions under pyo3 0.28" — which a recreate would force-push away.

There's also a reason to wait. pyo3 and pyo3-build-config are released in lockstep and PyO3 expects them on the same version, but Dependabot tracks them separately: #6258 already moved pyo3-build-config to 0.29.2 while pyo3 stayed on 0.27. This PR bumps pyo3 alone to 0.28.3, so merging it as-is would leave the pair split the other way. #6271 pins them back together and adds a pyo3 group to .github/dependabot.yaml; once that lands, a recreate here should produce a single grouped bump of both crates — at which point the FromPyObject fix above is the part worth carrying over by hand.

Superseded, so this approval no longer reflects a verdict I'd give today. #6271 merged on 2026-09-03 taking pyo3 to 0.29.2 and carrying the same FromPyObject opt-in that sits on this branch as e978f7c5, so merging this 0.28.3 bump would now move the workspace pin backwards. I'm dismissing my own APPROVED rather than leaving the PR reading as bot-approved; the reasoning in my earlier COMMENT review and the 2026-09-02 conflict note both still stand, and the branch is still CONFLICTING, which is what kept anything from merging in the meantime.

[prql-bot]

The blocker named in the deferral above has cleared: #6271 merged on 2026-09-03, moving both pyo3 and pyo3-build-config to 0.29.2 on main and adding the pyo3 group to .github/dependabot.yaml. It also carried over the FromPyObject fix this branch was holding — main now has #[pyclass(from_py_object)] on CompileOptions with a comment explaining the 0.28 deprecation.

That leaves this PR fully superseded: it proposes 0.28.3, two minors behind what main already carries, and its one non-lockfile source change is already there. Recreating so Dependabot re-evaluates against the current main — with the requirement already satisfied and the crates now grouped, it should close this out rather than raise the split bump again.

@dependabot recreate

[dependabot]

Looks like pyo3 is up-to-date now, so this is no longer needed.